# Hands-on Labs (/tutorials)

Every tutorial runs in a workspace and ends with a governed call you can verify in the audit trail. Follow the guided path in order, or jump to the track that matches your role.

## Get started [#get-started]

Four tutorials, in sequence. Each one builds on the workspace the one before it left behind.

1. [Govern your first agent](/tutorials/get-started/govern-your-first-agent): Allow, redact, and deny tool calls from Cursor, Claude, or curl.
2. [Call a model through a pool](/tutorials/get-started/call-a-model-through-a-pool): Route chat through a model pool with failover and server-side keys.
3. [Build a governed app](/tutorials/get-started/build-a-governed-app): Wire model and tool calls in one app. Watch allow, redact, and deny.
4. [Govern per end user](/tutorials/get-started/govern-per-end-user): Give each user different tool access and answers from the same agent.

## Choose your role [#choose-your-role]

What developer, security, operator, and platform admin each own on Dome, with a guided workspace walk for each.

* [Developer](/tutorials/role/developer): Register an agent, call tools through a gateway, and confirm allow and deny.
* [Security](/tutorials/role/security): Author and simulate Cedar, redact sensitive fields, prove denials, and export evidence.
* [Operator](/tutorials/role/operator): Attach tools, expose a gateway, grant access, and watch audit.
* [Platform Admin](/tutorials/role/platform-admin): Set who may administer Dome, check platform health, and export an audit snapshot.

## Production [#production]

Take what you built in the workspace and run it for real.

* [Use Dome as an MCP gateway](/tutorials/production/use-dome-as-an-mcp-gateway): Let Cursor, Claude Code, or Codex sign in with your own Dome account and call MCP tools, individually audited.
* [Use Dome as a model broker](/tutorials/production/use-dome-as-a-model-broker): Hold the provider key server-side and let Cursor, Claude Code, or Codex call any model, not just their own.
* [Govern callers with OIDC](/tutorials/production/govern-callers-with-oidc): Authorize a shared assistant from each employee's verified identity, then inspect every caller.
* [Deploy an always-on agent](/tutorials/production/deploy-your-agent/always-on): Build and deploy a governed HTTP service that stays ready for requests.
* [Deploy an event-driven agent](/tutorials/production/deploy-your-agent/event-driven): Build and deploy a governed handler that wakes for an event and exits.

## Examples [#examples]

Working applications you can clone and adapt.

* [Interactive app](/tutorials/examples/interactive-agent): A chess coach that acts for each player, beside a standing opponent.
* [Scheduled agent](/tutorials/examples/noninteractive-agent): A nightly GitHub report that cannot merge, comment, or file. Python, TypeScript, or Go.